Role Definition
| Field | Value |
|---|---|
| Job Title | USMC Offensive Cyberspace Warfare Operator (MOS 1721) |
| Seniority Level | Mid-Level (E-5 to E-7, SSgt to GySgt) |
| Primary Function | Conducts offensive and defensive cyberspace operations for Marine Corps forces. Employs cyber tools, tactics, techniques, and procedures to execute Computer Network Exploitation (CNE), Computer Network Attack (CNA), and defensive cyber operations (DCO). Integrates cyber effects into Marine Air-Ground Task Force (MAGTF) warfighting functions at tactical, operational, and strategic levels. Deploys with expeditionary forces. Operates under USCYBERCOM authorities via MARFORCYBER. Post-2021 modernisation merged the former 1711 (offensive) and 1721 (defensive) MOSs into a single operator capable of both offensive and defensive operations based on billet assignment. |
| What This Role Is NOT | NOT a Cyber Warfare Officer (17A/1702 -- commissioned officer with command authority, scored 59.4 Green Transforming). NOT a Navy Cyber Warfare Technician (CTN -- shipboard/shore Navy operations, scored 61.2 Green Transforming). NOT a Cyber Operations Specialist (Army 17C -- scored 47.0 Yellow Urgent). NOT a civilian penetration tester (no military authority, no clearance requirement, scored 35.6 Yellow). NOT an 06XX Data Systems Marine (network administration, not cyber operations). |
| Typical Experience | 4-10 years. Requires GT score 110+, TS/SCI clearance with favourable HQMC SSO prescreen. Training: Joint Cyber Analysis Course (Pensacola, ~3 months) + Cyber Operations Specialist Course (Fort Gordon, ~6 months). Total pipeline ~9 months. Certifications: Security+, CySA+, CEH, GPEN, or service-specific qualifications. May hold Necessary MOSs (NMOSs): 1712 Interactive On-Net Operator, 1713 Exploitation Analyst, 1714 Access Operator, 1722 Defensive Host Analyst, 1723 Defensive Network Analyst. |
Seniority note: Junior Marines (E-3/E-4) fresh from the training pipeline executing structured defensive tasks under close supervision would score lower -- mid-40s Yellow. Senior enlisted (E-8/E-9 Cyberspace Operations Chief) who plan operations, advise commanders, and manage programmes would score higher, approaching the Cyber Warfare Officer range (59-65).
- Protective Principles + AI Growth Correlation
| Principle | Score (0-3) | Rationale |
|---|---|---|
| Embodied Physicality | 1 | Core work is digital, but USMC cyber operators deploy with expeditionary forces -- MEUs, MEFs, and forward-deployed MIGs. Unlike Navy CTNs on ships or Army 17Cs at garrison, Marines routinely operate from austere forward locations with limited infrastructure. Not Moravec's Paradox-level physicality, but genuine expeditionary presence requirements. |
| Deep Interpersonal Connection | 1 | Team operations within small units. Training junior Marines, coordinating with intelligence and operations sections, operating as part of a tightly integrated MAGTF. Interpersonal trust matters within the team but is not the core value proposition. |
| Goal-Setting & Moral Judgment | 2 | Significant autonomous judgment during cyber operations -- ROE interpretation, escalation decisions, proportionality assessment for offensive effects. Operates within chain of command but exercises substantial tactical discretion on classified systems. Not at officer command authority level (3), but well beyond playbook execution (1). |
| Protective Total | 4/9 | |
| AI Growth Correlation | 1 | Adversary AI capabilities (AI-generated malware, automated exploitation, AI-assisted APT campaigns) expand the threat landscape requiring human cyber operators. USMC AI Implementation Plan (May 2025) positions AI as force multiplication for cyber operations, not personnel reduction. Demand driven by geopolitical environment broadly, not AI adoption specifically. |
Quick screen result: Moderate protection (4/9) with strong judgment component and positive AI correlation suggests Green Zone -- structural military barriers are the dominant factor.
Task Decomposition (Agentic AI Scoring)
| Task | Time % | Score (1-5) | Weighted | Aug/Disp | Rationale |
|---|---|---|---|---|---|
| Offensive cyberspace operations (CNE/CNA) | 25% | 2 | 0.50 | AUGMENTATION | Executing offensive cyber operations against adversary targets -- exploitation, access operations, and attack. AI assists with vulnerability discovery and payload generation, but the operator determines target engagement, timing, and proportionality under LOAC/ROE. Novel adversary environments on classified air-gapped systems prevent use of commercial AI. Human authorisation required through chain of command. |
| Defensive cyberspace operations (DCO) | 20% | 3 | 0.60 | AUGMENTATION | Hunting for adversary presence within friendly networks, incident response on classified systems. AI-powered threat detection accelerates anomaly identification for known signatures, but classified infrastructure prevents deployment of commercial AI platforms. Operator directs defensive posture, makes containment decisions, and coordinates response. The structured/signature-matching portion of DCO trends toward automation. |
| Cyber tool development & capability engineering | 15% | 2 | 0.30 | AUGMENTATION | Developing and maintaining offensive/defensive tools within classified environments. Air-gapped networks prevent use of commercial AI coding assistants. Custom exploit development against hardened military targets requires adversarial creativity. AI assists with some code generation when purpose-built classified tools are available, but the 3-5 year lag between commercial and military AI capability limits current impact. |
| Threat analysis & intelligence integration | 15% | 3 | 0.45 | AUGMENTATION | Analysing SIGINT, network intelligence, and adversary TTPs. AI accelerates data processing and pattern correlation across large datasets. The operator evaluates intelligence quality, develops adversary hypotheses, and produces targeting recommendations with operational consequences. AI processes signals; Marines interpret meaning and context. |
| Network enumeration & vulnerability assessment | 10% | 4 | 0.40 | DISPLACEMENT | Scanning and enumerating friendly and adversary networks using automated tools. Largely tool-driven with defined procedures and verifiable outputs. AI agents can execute end-to-end with minimal human oversight. The operator reviews results but the scanning itself is displacement-eligible. |
| MAGTF integration & expeditionary cyber support | 10% | 1 | 0.10 | NOT INVOLVED | Deploying with Marine expeditionary forces, integrating cyber effects into ground combat operations, briefing tactical commanders on cyber capabilities. Operating from forward-deployed locations with limited connectivity. Military coordination requiring physical presence, human authority, and face-to-face trust in austere environments. No AI involvement. |
| Training, readiness & team operations | 5% | 1 | 0.05 | NOT INVOLVED | Training junior Marines, maintaining unit readiness, conducting exercises. Military mentorship and small-unit leadership are irreducibly human. |
| Total | 100% | 2.40 |
Task Resistance Score: 6.00 - 2.40 = 3.60/5.0
Displacement/Augmentation split: 10% displacement, 75% augmentation, 15% not involved.
Reinstatement check (Acemoglu): Yes. AI creates new tasks: countering AI-powered adversary operations, validating AI tool outputs in operational contexts, developing AI-specific cyber weapons on classified platforms, defending military AI/ML systems, and integrating AI capabilities into expeditionary cyber operations. The role is expanding to encompass AI-enabled warfare.
Evidence Score
| Dimension | Score (-2 to 2) | Evidence |
|---|---|---|
| Job Posting Trends | +1 | Pentagon short 20,000+ cyber professionals as of Jan 2026 (Federal News Network). USCYBERCOM Cyber Mission Force expanding from 133 to 147 teams. MARFORCYBER actively recruiting 17xx Marines. Chronic shortage of cleared cyber operators across all services. Military cyber billets consistently unfilled. |
| Company Actions | +1 | USMC released AI Implementation Plan (May 2025) positioning AI as force multiplier, not personnel reduction. USCYBERCOM FY2026 budget includes new AI program ($5M within $1.3B R&D). Congress directed five-year AI roadmap for cyber operations forces. USMC Digital Transformation Teams deploying AI strategy (Feb 2026). No military branch reducing cyber operator billets. |
| Wage Trends | 0 | Military compensation is structured (E-6 with 8 years: ~$55K base + BAH/BAS = ~$70-85K total). Below civilian equivalents ($120K-$180K for equivalent cleared roles). Retention bonuses exist but are less aggressive than officer-level incentives. Real terms are stable, not surging. Post-separation, cleared cyber Marines command premium civilian salaries. |
| AI Tool Maturity | +1 | USCYBERCOM's FY2026 AI program is establishing data standards, not deploying production AI for operations. Classified environments prevent use of commercial AI platforms. Air-gapped networks mean AI tools must be purpose-built for military use. The 3-5 year lag between commercial AI maturity and military deployment provides substantial additional protection. No viable AI alternative for classified offensive operations exists. Anthropic observed exposure for Information Security Analysts (parent SOC 15-1212) is 48.6%, but military classification gap means actual exposure is significantly lower. |
| Expert Consensus | +1 | FDD (Sep 2025): existing programmes "cannot rectify military cyber workforce and talent management shortfalls" -- recommends a dedicated US Cyber Force. USMC AI Implementation Plan explicitly frames AI as augmentation. DoD Directive 3000.09 requires human judgment for use-of-force decisions including cyber effects. Consensus across defence analysts: military cyber operators are needed more, not less. |
| Total | 4 |
Barrier Assessment
Reframed question: What prevents AI execution even when programmatically possible?
| Barrier | Score (0-2) | Rationale |
|---|---|---|
| Regulatory/Licensing | 2 | TS/SCI clearance with HQMC SSO prescreen mandatory -- 12-18 month process. No AI system holds a clearance. Operations under Title 10/50 legal authorities require human authorisation. LOAC and ROE mandate human decision-making for offensive cyber effects. DoD Directive 3000.09 requires "appropriate levels of human judgment" for weapons systems including cyber. |
| Physical Presence | 1 | USMC cyber operators deploy with expeditionary forces -- MEUs, forward-deployed MIGs, austere locations. Unlike garrison-based Army 17Cs or shipboard Navy CTNs, Marines operate from contested environments with degraded communications. This adds a physical presence barrier absent from most military cyber roles. Not unstructured physical work (score 2), but genuine forward deployment requirements. |
| Union/Collective Bargaining | 1 | Military enlistment contracts, promotion systems, and Congressional force structure authorisations provide structural employment protection. Not unionised, but military service is not at-will -- separation requires formal process. Congressional authorisation controls Marine Corps end-strength. |
| Liability/Accountability | 2 | Marines bear personal criminal liability under UCMJ for operational decisions. Unauthorised or disproportionate cyber attacks can constitute war crimes. Chain of command accountability means a human must bear ultimate responsibility. AI has no legal personhood, cannot hold a military rank, and cannot face court martial. This is a structural barrier that does not erode with technology advancement. |
| Cultural/Ethical | 1 | Marine Corps culture demands human leadership and personal accountability at every level. The concept of an AI system executing offensive cyber operations under military authority is culturally unacceptable. International norms resist autonomous offensive operations. However, the Marine Corps actively embraces AI as a tool -- resistance is to AI replacing human authority, not to AI assisting operators. |
| Total | 7/10 |
AI Growth Correlation Check
Confirmed at 1 (Weak Positive). Adversary AI adoption -- AI-generated malware, automated exploitation frameworks, AI-assisted APT campaigns -- expands the threat landscape requiring human-led cyber operations. The USMC AI Implementation Plan and USCYBERCOM AI roadmap position AI as force multiplication, explicitly framing AI as augmenting cyber operators rather than replacing them. But demand for Marine cyber operators is driven by the broader geopolitical and military threat environment, not AI adoption specifically. Not Accelerated Green (2) because the role would exist regardless of AI -- AI expands the scope but does not create the role.
JobZone Composite Score (AIJRI)
| Input | Value |
|---|---|
| Task Resistance Score | 3.60/5.0 |
| Evidence Modifier | 1.0 + (4 x 0.04) = 1.16 |
| Barrier Modifier | 1.0 + (7 x 0.02) = 1.14 |
| Growth Modifier | 1.0 + (1 x 0.05) = 1.05 |
Raw: 3.60 x 1.16 x 1.14 x 1.05 = 4.999
JobZone Score: (4.999 - 0.54) / 7.93 x 100 = 56.2/100
Zone: GREEN (Green >= 48)
Sub-Label Determination
| Metric | Value |
|---|---|
| % of task time scoring 3+ | 45% |
| AI Growth Correlation | 1 |
| Sub-label | Green (Transforming) -- 45% >= 20% threshold, Growth != 2 |
Assessor override: None -- formula score accepted. At 56.2, the USMC Offensive Cyberspace Warfare Operator sits below the Cyber Warfare Officer (59.4) and near the Navy Cyber Warfare Technician (61.2). The lower score compared to Cyber Warfare Officer reflects the enlisted vs officer distinction: less command authority, more hands-on technical execution, and lower task resistance (3.60 vs 3.85). The difference from the Navy CTN reflects a different barrier/evidence mix: higher barriers (7 vs 5 -- USMC expeditionary deployment adds physical presence) but lower evidence (4 vs 7 -- Navy CTN had stronger individual demand signals). Both correctly land in Green (Transforming). The score accurately positions this as a high-judgment, barrier-protected enlisted military cyber role undergoing active AI transformation in its tooling.
Assessor Commentary
Score vs Reality Check
The Green (Transforming) classification at 56.2 is honest and well-calibrated. Barriers (7/10) contribute a 14% boost via the modifier -- meaningful but not distorting. These barriers are overwhelmingly structural: TS/SCI clearance requirements, UCMJ accountability, and LOAC mandates exist because of how legal systems and military institutions work, not because of a technology gap. They will not erode as AI improves. The score sits comfortably above the Green/Yellow boundary (48) with an 8.2-point margin, so borderline risk is low.
What the Numbers Don't Capture
- Classification as a moat. The most capable commercial AI tools cannot operate on classified air-gapped networks. Military cyber operations require purpose-built AI tools cleared for classified environments -- and USCYBERCOM is only now establishing data standards (FY2026). The 3-5 year gap between commercial and military AI capability provides protection beyond what the evidence score captures.
- Retention crisis masks demand. Military cyber operators leave for private sector roles paying 2-3x military compensation. The 20,000+ DoD cyber vacancy figure understates true demand because it only counts billets, not the quality gap created by experienced operators separating.
- MAGTF integration is unique. No other service integrates cyber operations into expeditionary ground combat at the tactical edge the way the USMC does. This creates demand for operators who can function in austere, forward-deployed environments -- a requirement no AI system can meet.
- MOS modernisation expanding scope. The 2021 merger of 1711/1721 into a single MOS means each Marine is now trained in both offensive and defensive operations. This broadens the skillset and increases individual versatility, making each operator harder to replace.
Who Should Worry (and Who Shouldn't)
Mid-level Marines (SSgt/GySgt) executing offensive operations, developing custom tools on classified systems, and deploying with expeditionary forces are in the strongest position. Their value is protected by multiple structural barriers that no amount of AI capability can erode -- clearance, legal authority, physical deployment, and accountability under UCMJ.
Marines whose primary duties are structured defensive monitoring -- watching dashboards, triaging alerts against known signatures, following playbooks on classified networks -- face the same pressure as their civilian SOC analyst counterparts, delayed by 3-5 years due to classification constraints. As purpose-built military AI matures, the routine monitoring portion of their work will compress.
The single biggest separator: whether your value comes from executing offensive operations requiring adversarial creativity and legal judgment, or from performing structured defensive monitoring that follows prescribed procedures. Both are currently human-executed, but only the former is structurally irreducible.
What This Means
The role in 2028: The USMC Cyberspace Warfare Operator of 2028 works alongside AI-powered tools that accelerate threat detection, automate network enumeration, and assist with intelligence correlation. But the Marine still executes offensive operations under legal authority, deploys with expeditionary forces, develops custom tools on air-gapped systems, and bears personal accountability for cyber effects. The role shifts from manual technical execution toward directing AI-augmented cyber operations -- commanding tools rather than being replaced by them.
Survival strategy:
- Lean into offensive operations and adversarial creativity. The highest-resistance tasks are offensive cyber operations under legal authority. Pursue NMOSs (1712 Interactive On-Net Operator, 1713 Exploitation Analyst, 1714 Access Operator) that build offensive expertise. This is where structural protection is strongest.
- Develop AI-enabled operations skills. As USCYBERCOM deploys purpose-built AI tools for classified environments, be the operator who can evaluate AI outputs, identify AI limitations against hardened targets, and integrate AI into expeditionary cyber operations. The USMC AI Implementation Plan will define the next generation of cyber operations.
- Maximise MAGTF integration experience. Deployments with MEUs, forward-deployed MIGs, and joint exercises build the expeditionary cyber expertise that has no civilian equivalent and no AI substitute. This is career insurance both within the Marine Corps and for post-separation transition.
Timeline: 5+ years. Structural barriers (clearance, UCMJ accountability, classification constraints, expeditionary deployment) provide indefinite protection for the core role. AI transforms the tooling and accelerates execution, but does not displace the cleared Marine who must bear legal responsibility for cyber effects.
